A penetration tester is reviewing the following SOW prior to engaging with a client: "Network diagrams, logical and physical asset inventory, and employees' names are to be treated as client…

Using proprietary tools is generally acceptable unless explicitly forbidden by the SOW or if it implies a lack of transparency that would hinder the client's ability to replicate findings.

Utilizing public-key cryptography to deliver findings securely aligns with the SOW's requirement to submit findings via "encrypted protocols" and is an ethical and responsible practice.

Failing to share critical vulnerabilities with the client is unethical because the core purpose of a penetration test is to identify and report such weaknesses to improve the client's security posture. Withholding this information defeats the purpose of the engagement.

Sharing the client's public IP address in underground hacker forums, even while seeking help, constitutes a breach of confidentiality and trust, as it exposes the client's identity and potential targets to malicious actors, which violates the SOW's confidentiality clause regarding network diagrams and asset inventory.

Using a software-based erase tool to wipe findings is a secure manner of disposal and aligns with the SOW's requirement to "dispose of all findings by erasing them in a secure manner."

Retaining the SOW itself for internal company use (e.g., sales, project management) is standard business practice and does not typically violate the confidentiality of the client's operational data defined in the SOW.